Sussmann, Michael A. (Perkins Coie) 


From: Sussmann, Michael A. (Perkins Coie) 
Sent: Thursday, September 8, 2016 6:39 PM 
To: Hawkins, E. A. (WF) (FBI) 

Cc: Ryan McCombs 

Subject: Re: Notification 

Thanks. 


Michael Sussmann | Perkins Coie LLP 
P: 202.654.6333 
www.perkinscoie.com/msussmann 


From: "Hawkins, E. A. (WF) (FBI)" <Adrian. Hawkins @ic.fbi.gov> 
Date: Thursday, September 8, 2016 at 1:03 PM 


To: Michael <msussmann @perkinscoie.com> 


Cc: Ryan McCombs <ryan.mccombs@crowdstrike.com> 
Subject: Re: Notification 


??Only targeting. No information to suggest compromise. 


E. Adrian Hawkins 
Special Agent 
Washington Field Office 


cee 6574 


From: Sussmann, Michael A. (Perkins Coie) <MSussmann@perkinscoie.com> 
Sent: Wednesday, September 7, 2016 11:01 AM 

To: Hawkins, E. A. (WF) (FBI) 

Ce: Ryan McCombs 

Subject: Re: Notification 


Thank you, Adrian. 


In this context, do you only have information regarding targeting, or can you confirm successful 
compromise of the accounts? 


Regards, 
Michael 
Michael Sussmann | Perkins Coie LLP 


P: 202.654.6333 
www. perkinscoie.com/msussmann 


SCC_0000545 


No. 1:21-cr-00582-CRC (D.D.C.) DX-140_0001 


From: "Hawkins, E. A. (WF) (FBI)" <Adrian. Hawkins @ic.fbi.gov> 

Date: Wednesday, September 7, 2016 at 10:28 AM 

To: Michael <msussmann @perkinscoie.com>, Ryan McCombs <ryan.mccombs@crowdstrike.com> 
Subject: Re: Notification 


Gentlemen, 


Related to this, the following accounts may have been targeted: 


fernandezM@dnc.org 
MeloyS@dnc.org 
RiveraP@dnc.org 


Also, FireEye released an excellent report on the activity, 16-00013238 CE. 


?E. Adrian Hawkins 
Special Agent 
Washington Field Office 


REDACTED gag 


From: Hawkins, E. A. (WF) (FBI) 

Sent: Friday, August 26, 2016 7:05 PM 

To: Sussmann, Michael A. (Perkins Coie); Ryan McCombs 

Cc: Burnham, Michael (CYD) (FBI); Alwine, Sarah E. (WF) (FBI) 
Subject: Notification 


Gentlemen, 


It's come to our attention there may be an ongoing COZY campaign. This campaign is slightly different than 
previous campaigns. The campaign seems to include a .doc or an .xls (possibly Eurasia themed) containing 
macro-malware. Previous campaigns used a hyperlink to a .zip file. Phishing e-mails may actually 
originate from vt.edu and be spoofed to look as if they come from a legitimate source (i.e., a think tank). 


The domain: 
democrats[.]org 


may have been targeted in this campaign. 

? 

Crawdberike - Please advise if any additional information can be provided and/or if activity is observed. 
(CyD and CY-3 A/SSA cc'd) 

v/r, 


Adrian 


E. Adrian Hawkins 
Special Agent 
Washington Field Office 


C 6674 


SCC_0000546 


No. 1:21-cr-00582-CRC (D.D.C.) DX-140_0002 


NOTICE: This communication may contain privileged or other confidential information. If you have received it in error, please advise the sender by reply 
emall anc immediately delete the message and any attachments without copying or disclosing the contents. Thank you. 


NOTICE: This communication may contain privileged or other confidential information. If you have moeived it in error please advise the sender by reply 
email anc immediately delete the message and any attachments without copying or disclosing the contents. Thank you. 


SCC_0000547 


No. 1:21-cr-00582-CRC (D.D.C.) DX-140_0003 


